GSAST/docker-compose.yml at main · seznam/GSAST · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
services:
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    command: redis-server --appendonly yes
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  gsast-api:
    build:
      context: .
      target: base
    ports:
      - "5000:5000"
    environment:
      - REDIS_URL=redis://redis:6379
      - GITHUB_API_TOKEN=${GITHUB_API_TOKEN}
      - GITLAB_API_TOKEN=${GITLAB_API_TOKEN}
      - GITLAB_URL=${GITLAB_URL:-https://gitlab.com}
      - API_SECRET_KEY=${API_SECRET_KEY:-dev-secret-key-change-in-production}
      - FLASK_ENV=${FLASK_ENV:-development}
      - SSL_CERT_FILE=/app/certs/ca-bundle.pem
      - REQUESTS_CA_BUNDLE=/app/certs/ca-bundle.pem
      - GIT_SSL_CAINFO=/app/certs/ca-bundle.pem
    depends_on:
      redis:
        condition: service_healthy
    volumes:
      - ./gsast-core/gsast_core:/app/gsast-core/gsast_core:ro
      - ./gsast-api/gsast_api:/app/gsast-api/gsast_api:ro
      - ./certs:/app/certs:ro
      - scan_results:/app/results
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:5000/health"]
      interval: 30s
      timeout: 10s
      retries: 3

  gsast-worker:
    build:
      context: .
      target: base
    command: gsast-worker
    environment:
      - REDIS_URL=redis://redis:6379
      - GITHUB_API_TOKEN=${GITHUB_API_TOKEN}
      - GITLAB_API_TOKEN=${GITLAB_API_TOKEN}
      - GITLAB_URL=${GITLAB_URL:-https://gitlab.com}
      - API_SECRET_KEY=${API_SECRET_KEY:-dev-secret-key-change-in-production}
      - SSL_CERT_FILE=/app/certs/ca-bundle.pem
      - REQUESTS_CA_BUNDLE=/app/certs/ca-bundle.pem
      - GIT_SSL_CAINFO=/app/certs/ca-bundle.pem
    depends_on:
      redis:
        condition: service_healthy
    volumes:
      - ./gsast-core/gsast_core:/app/gsast-core/gsast_core:ro
      - ./gsast-worker/gsast_worker:/app/gsast-worker/gsast_worker:ro
      - ./certs:/app/certs:ro
      - scan_results:/app/results
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "python", "-c", "import redis; r=redis.from_url('redis://redis:6379'); r.ping()"]
      interval: 30s
      timeout: 10s
      retries: 3

volumes:
  redis_data:
  scan_results:

# For production, consider adding:
# networks:
#   gsast_network:
#     driver: bridge